Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
16-12-2024 09:54
General
-
Target
PO#5_tower_Dec162022.html
-
Size
1.2MB
-
MD5
b2641a4ba8ebb6014d67d8e9a78acce7
-
SHA1
396b9b7b85e6c61917eed60d774f183bf071775e
-
SHA256
e2fdd71bb2b39a38ff9556cb57d0086f40224a76857540c98aaab76dd59021c2
-
SHA512
d80ca65a9e15d2ddc22aa25879e345e5061b906d481bccf6333dbb56e37200c034568cc0bf609a1676b73f3ff404ecaa44bf444606dc496ca9ae9634135d0ad2
-
SSDEEP
12288:sW7OJjd8FCSHkCJQwBgeeMXU3563tNw26HSg2BNjHyn5bAzJ1bErWdqDrVk7W/WS:+dDC6w0MEM3t2WnDylDuZ+kinyvLZc
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 61 IoCs
-
Executes dropped EXE 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
-
Modifies Internet Explorer settings 1 TTPs 36 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\PO#5_tower_Dec162022.html1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2404 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8452S9S3\PO_0856580RY_MQ1094757_Reff_0957_Order.pif"C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8452S9S3\PO_0856580RY_MQ1094757_Reff_0957_Order.pif"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
Filesize
252B
MD555af6e371178b95bc208736faba7ab76
SHA1555fd844289cb61e2a814539e194488fed00ab7c
SHA256e51f5f40709967bc3576bfbc3b289daf66518259e0168d0831d925b20da28d09
SHA5122cd306d188ecd08599641192c770c6ba3ad8301a91ac1e5289a6d4aba0c172964ab50971ad35789d4a80680e17c3f7741714b69d43164c254cd88eebc5a69a81
-
Filesize
342B
MD55a35ddd1f05978e508a2008ab8ddb99e
SHA1eeab40c763f2c58e3976a14aba9270d8a60ed0c4
SHA2569a03f5018515ad2b5fd5192c46b2c56ade4e6dd42814aba5fdbf3808f6c36121
SHA51228afdeb82ad8bb003d9eb36803bde68422d3a040f6c894d4c25945b1b3e3db714ff53a153cbce867ff10194b5d922598fbae9ef2c19b3c9222fbb705e6a07914
-
Filesize
342B
MD5fc28d28c5587c25bbef341a0c41b25a1
SHA1490b49de2ec6c7c74a68980978be25f373080d01
SHA2568fd6d2054e16ad242ebca2ff472da40e85517340c992b24d8a767fe32a07a620
SHA51210b2648b24df4d72543f6a8ff05457117e203d83012d06ba9612f6f97a0a42ca2825cb448759cf297218273b13299bae4f136a5b9e7ca49ba53e37ddc63c8472
-
Filesize
342B
MD5adc138145f34e5a5bb23b1cccf3c8824
SHA1f79f7f61fd5e709708979e6fd685e02b1342d8e9
SHA25693de3e68a14b67cb126a1f3d20ed83f3e1a3c294e78f3391ea31ed85226149b7
SHA51232b4862566bdf97d0b82e169b720a60ad6d3e24f99b28615520b17621dbeebb7b1380beb9160256ffde91a9e6bb87526b50257db1b3bf6286faccb5fa7c8d29a
-
Filesize
342B
MD52f619078d1beee1e60af09f5ec7db4a8
SHA1dc7123f2f6dd970acc9e03fe29d210f6a2c8068d
SHA256b52f6705dfc78a2268c916b0cb360888d098fc21022e7e4f44fd645d90ebe487
SHA51201af14feaa761b6e1225648796cfa2afb4f35a33b5f3292e05c95fc3c8cbb4440e6a05aec11e937621fe934884dd06f9e807765725201aa141e46c3d5101bf5c
-
Filesize
342B
MD5bba340d0f63a1943ac1b6a09db7ff686
SHA1a1b775c2e7938851c9bda33a593f84eb311057d5
SHA25638676fbfd8660542546ff270614e4271308bb86365959c52a8f66d65d347ba7f
SHA512307043bad438a825bb1afec72b732da3d31dfa1139bf938fd38de20de3937c8b57c1c264e49576ad919e73e99c7f98ad37f4243f6e1ff97bdaa4b7a36fcb5214
-
Filesize
342B
MD5e348ab5fd3b24f3d5005e1177ce1362a
SHA1ebb9518301b00670b8437eb115c95182e6f00aff
SHA256dff342f537b27f5fad7e7e0d5e90e716c59cf86e72f83b18eb0e8b4808c53350
SHA5128cbb8e09e754a5d430ba7777a9b253349fa3aed8ce25d14465f5b5a35682d4374b39fb09d9780782f150a5fe107d772533f69509d7e5de932893e01b037e12c0
-
Filesize
342B
MD59b9ff709aa67324151e6cf56222c4520
SHA10e2f5b4cca8bb6e92965516cc6fbf21802d5e5df
SHA256ad21d65257c5e96c312ca5d856cb8c4505e5bb655136b7eecca9e26a629b135d
SHA51297428d18998918f936d670123a31f76ae0b3c0aae17425541b5f46d1d778ad3be365cc53b99ad101ba232d10c3d3e44cb73c3cfda0fcdfd12de82ce76169bf8a
-
Filesize
342B
MD548743c7b72af1055bd7925da1b521fae
SHA1367e419da39dd438860eb28728f21075dcd71215
SHA256bef82336c9a3bc239aa751ca13d58b8be1355e1cb61f8b53596144cc5ee46d30
SHA512827d4148620fa406a6d1163c89fec4d96c970d32412bfb57bce86c108ff09bb1438ba721a2907686081cfe85b7509cc3bad6b1f530268f57afde73bc67b0d658
-
Filesize
342B
MD564308270459ef760c61fa90f3d2f7d9f
SHA1f0c927caba00fc40007256101d88ec9ea7c4846e
SHA256c500d048dc7477dc114730513c7183b4c97abcbaf4e47b8462150e59cd0a1619
SHA512474b53e0b284937e92ca9b9d4fa72ae2134014334d82d90f1a35e690b0210e7d6b3171d3b42409fe28167d285f87eafe51e38b3e79c97f7ff34295e11e419e2b
-
Filesize
342B
MD572bde30be9b5e79e888833f0331c5c83
SHA1b8e3ab9e3d6bfce7f4f9bb990ee85ca31e6c9b56
SHA2562613f4b83086fd376073c2295c4a0940aefe26c1860ec3047677682bfaed8e40
SHA512c75e5e3db4026f696f5863cf1a6a94b7c28eb8b3e9379513b9eea575c2dd39f4d9fc44eb6640460534b160418d7dd05d89c5b7a93a67f8233820f25217f8e512
-
Filesize
342B
MD524dcb55e384a5671bab8a9fa564ca4fb
SHA1ef0aec8669e79bd31ac3eaedc73b74e062658cfd
SHA2562676b0dc6abf1e4f7bccdc68d5ee3493b734b5d6256b9fa568927478cc8af425
SHA512c083791bf9d206f8a806f852080479010be4d2a7c75bbcc85b834f5b93267d57f3a92c0c991353f1e915b4a595797ecec119463ee3971f9e8ff1c9e1e57b60eb
-
Filesize
342B
MD578768bc74565ad73343a9bcd3029178e
SHA15bcfe7a73ec937d48ebfcd14e9e19855d6b0dd67
SHA256feb04decab556eeb0cc98c68d19e505e743c33db9f9cd6cae23f0d4c05380e39
SHA5120b53765ae43ea625eb64dd3291e35272519ac29d09184d6c0511cab4adecc03b5fff9894640f1d01ad0f3da124aef5c5479192f6ddaf126904796169f3170300
-
Filesize
342B
MD52429c5afdda1fae9e5f51254fb0bba7b
SHA154ea746d2073686114da8975c37ba419de9cefd5
SHA25689d0476498fc048eb25c16b4fab8f313b13bf740961c1440f3ae65886603221c
SHA51266f03d92bea6e1ccfc7966bde35e3a8cb6f71192cc3c08b15248eec1fed64ceb170d7843c753d2aa6e5e9fb012191649dc6bc7d46dd9a64f8ff990c39b3fa0f8
-
Filesize
342B
MD545d5d27d681f0ae6199c9ecfb51d014a
SHA19eba6e4c7e7c994efab7f888e1ce627a618f9d39
SHA256b385f635278b7c3d87cef25fd1f4420f2ce5de57587c1c7fe629068d630ef4fc
SHA512a4d4de0db3c4e650d561ce29bf63c41843c7abce4b3856040daa8680e32c1fb2f9cb2a4ce90c4bfe7bf8331b7e3e45e1bcef1f1ade8a902a0622fadb8e8d2bf1
-
Filesize
342B
MD5cc167323e6f5aad332217e340f6fe070
SHA1adacbfb8b4b4626c04e9760b5f6fcf144eb1cc71
SHA256a7f0e482e9b9a4ec5a560bdf3aef178682b55d6a260bd63c61764c89be4a687d
SHA51238cbda229f55de10da3910df77dbee47c59f71f9035afd0744b2fd9edec2f50ae2dbb8bac33d696e23c68fb72ee719a29b55b687d204c69d23162db5cbea06a7
-
Filesize
342B
MD5c73a6d6d157dde6860dcadc41b2fceb6
SHA1c79d910a02adac413a3e2262b54825f110cddc76
SHA256925457913b6d0a8409865632d897efd21dd737ea073e7c6e65f20ac68946d054
SHA512e759e729689b034de0287f4157461ac127f2cd53a965940400efd18d0a495b9cf820bb4f1db70dfc4111a10af38b7c4a2d8a7540984ed61662a3ffa992530f61
-
Filesize
342B
MD5ce6929698d782ec995656b11fe465032
SHA118170f77f0df3fee9303d26b4dbd8829a31d3320
SHA256d87fa77d832f9ee3641e74ddf16b112419603569876ae9005486a664f3fa725d
SHA5125671b38e8551f08ed58b5608059b2dcd93e6d1c3b100c37c1e89eeda9563d0b9fc681260eb3b7dee22c140ca8065265a831fcd127b386081e271872638eb2204
-
Filesize
342B
MD543827774e233f28256658cd7d71c6fd5
SHA14bdcb01db35d1da0f6c93a73cfb06c7dcb771b30
SHA2563e1c096d71aade97ce05e093c9d0e7ae2525c50108c599d830a992b4f3256641
SHA512c3941f0d22fc3869a220a5c6ff695aff6d736035ba04d1c8663409a03c52f6b6a9ee7b5506e5893dc4c2e297c9b8b8ec811b534a126dbb813f6be95240244b4e
-
Filesize
342B
MD5a428d2f0073658d309822c7ea3b6d4e8
SHA1d390e4627fac12283fe54f549909380dd3e43eb2
SHA2561c9cc71bcf16b62195483b58db9eab49ae725ff656d92c485e7625bf666929e7
SHA51276c127d28c1ef354eb2d44a521d137d054d20728cac46d560e819aaa4b01d43a6e4b77309a81e21b496d587a59685e1d7d84f4891f5f97a5c3ce7e3d477a4580
-
Filesize
242B
MD5ad6cef8b1f78cf37cc123def5bff4b6c
SHA16d53aab0cf707953c7afb21a57dc10b7f80ea819
SHA25629077fb45d94ed2b7cd67cc5e29b18c712727c73c4ef0f46fcc809fc8e635d20
SHA512311849fad18186da271b61735495b5503a287f8df718e08a3934d196cd196108023daf5854c1dd1ab58b8ffff32d0cb709548ea7f2001cc588966171c547fb94
-
Filesize
932KB
MD5ab75907a33d670348e8fbf8fe85a10b8
SHA138e16c806df3cb34c6ba31a2ee9e14a9ba317ea4
SHA256e5d1f14db3695ee7fa122585054c6544a82db540f29b23ce77c4aaa86db85f4c
SHA5120d602cb989cd16ef3d55821dee0c40c30997c1cb33818e5de4afb2327f85a0f904229107225b5396203dde92bd4f1feb805ac4e42edaceaeb121038184e5166e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
968KB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
4KB
-
Filesize
16.0MB